{"id":7991,"date":"2015-02-07T00:01:00","date_gmt":"2015-02-07T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2015\/02\/07\/weekend-scripter-use-powershell-to-delegate-administrator-of-rodcs\/"},"modified":"2019-02-18T10:30:44","modified_gmt":"2019-02-18T17:30:44","slug":"weekend-scripter-use-powershell-to-delegate-administrator-of-rodcs","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-use-powershell-to-delegate-administrator-of-rodcs\/","title":{"rendered":"Weekend Scripter: Use PowerShell to Delegate Administrator of RODCs"},"content":{"rendered":"

Summary<\/b>: Microsoft PFE, Ian Farr, discusses using Windows PowerShell to delegate administrator of RODC.<\/span>\nMicrosoft Scripting Guy, Ed Wilson, is here. Today we have Honorary Scripting Guy and Microsoft PFE, Ian Farr, back for more words of wisdom…\nWelcome to the third post in a four part series about securing and managing read-only domain controllers (RODCs). I like to think of this collection of posts as “organic”—they only became a series after the green shoots of the first two posts were already well established!\nThe first post discussed a function that analyses RODC authentication. The function reports on accounts that are authenticated by an RODC that aren’t revealed (that is, the account password or secret is not stored on the RODC). It helps you manage your password replication policies. For the full write up, see Use PowerShell to Work with RODC Accounts<\/a>.\nThe second post discussed a function that checks whether a user is a member of a high-privileged group. It can be used in conjunction with the first function to see if your RODCs have authenticated high-privileged users. This helps identify and remove a potential means of compromising Active Directory. To read that post, see Use PowerShell to Search Active Directory for High-Privileged Accounts<\/a>.\nToday’s post discusses a function that allows you to delegate the administration of an RODC. The function adds a user or a group to the ManagedBy<\/b> attribute of the computer account for the RODC. This grants the user or group members local administrative privileges on the RODC.<\/p>\n

Note<\/b>  Users delegated as RODC administrators should not be a member of any privileged groups in Active Directory because this negates the protections that an RODC provides. Furthermore, the accounts used for delegated administration should be “secondary logon accounts” that are used only for RODC administration. For example, they should not be accounts that are also used to log on to workstations for typical user activity, such as Internet browsing or reading email.\nHere’s the function: Set-ADRodcManagedByAttribute<\/a>\nLet’s take a look…\nThe function has two parameters: Rodc<\/strong> and Principle<\/strong>.\nRodc<\/b>  This parameter determines the RODC on which the ManagedBy<\/b> attribute is set. It can accept a value from the pipeline, so we can pipe a list of RODCs into the function. There’s also some parameter validation to ensure that we are dealing with an RODC. If the domain controller object has the IsReadOnly<\/b> attribute set to True, we know we have an RODC.<\/p>\n

[parameter(Mandatory,Position=1,ValueFromPipeline)]<\/p>\n

[ValidateScript({(Get-ADDomainController -Identity $_).IsReadOnly})]<\/p>\n

[String]$Rodc\nPrincipal<\/b>  This parameter defines the user or group that is added to the ManagedBy<\/b> attribute. It has to be a DistinguishedName<\/a>. The parameter validation uses the –Identity<\/b> parameter of Get-ADObject<\/b>, which only accepts a distinguished name and will check whether the user or group exists in Active Directory. The ManagedBy<\/b> attribute should be populated with a domain local group.<\/p>\n

[parameter(Mandatory,Position=2)]<\/p>\n

[ValidateScript({Get-ADObject -Identity $_})]<\/p>\n

[String]$Principal\nThe function has a Begin<\/b> statement block to perform further validation before each RODC object is processed. In the following script, we check that the object supplied to the Principal<\/b> parameter is a User<\/b> or Group<\/b> object. If it isn’t, we Break<\/b> out of the function.<\/p>\n

     Begin {<\/p>\n

        #Get the supplied AD Object<\/p>\n

        $ADObject= Get-ADObject -Identity $Principal -ErrorAction SilentlyContinue\n <\/p>\n

        #Check that $Principal is a user or group<\/p>\n

        If (($ADObject.ObjectClass -ne “user”) -and ($ADObject.ObjectClass -ne “group”)) {\n <\/p>\n

            #Write a message to the host<\/p>\n

            Write-Host “$Principal is not a user or group”<\/p>\n

            Break<\/p>\n

        }  <\/p>\n

     }  \nNext, we enter the Process<\/b> statement block. We iterate through each RODC that is passed into the function and use the Get-ADComputer<\/b> and Set-ADObject<\/b> cmdlets to update the ManagedBy<\/b> attribute. On the associated computer account object, to our user or group DistinguishedName<\/b>, the -Replace<\/b> parameter makes use of a hash table that references our user or group principal.<\/p>\n

Process {<\/p>\n

#Set the ManagedBy attribute<\/p>\n

Get-ADComputer -Identity $Rodc | Set-ADObject -Replace @{ManagedBy = $Principal}<\/p>\n

}  \nHere’s an example of how to use the function:<\/p>\n

Get-ADDomainController -Filter {IsReadOnly -eq $True} |<\/p>\n

Set-ADRodcManagedByAttribute -Principal “CN=RODC Admins,OU=Groups,DC=Fabrikam,DC=com”\nIn this command, we get all of the RODCs for the current domain and pipe them into the Set-ADRodcManagedByAttribute<\/b> function. This updates the ManagedBy<\/b> attribute of each corresponding computer object to the distinguished name of the RODC Admins<\/b> domain local group. Of course, we could also pipe a specific list of RODCs into the function to meet a particular administrative requirement, or simply run the function by itself against a single RODC.\nAnd that’s it. Next time out, I’ll talk about synchronizing our delegated RODCs administrators’ passwords to their respective RODCs.\n~Ian\nThanks, Ian. Join us tomorrow when Ian returns for the final part of this series.\nI invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.\nEd Wilson, Microsoft Scripting Guy<\/b> <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft PFE, Ian Farr, discusses using Windows PowerShell to delegate administrator of RODC. Microsoft Scripting Guy, Ed Wilson, is here. Today we have Honorary Scripting Guy and Microsoft PFE, Ian Farr, back for more words of wisdom… Welcome to the third post in a four part series about securing and managing read-only domain controllers […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,566,56,472,3,61,45],"class_list":["post-7991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-domain-controllers","tag-guest-blogger","tag-ian-farr","tag-scripting-guy","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft PFE, Ian Farr, discusses using Windows PowerShell to delegate administrator of RODC. Microsoft Scripting Guy, Ed Wilson, is here. Today we have Honorary Scripting Guy and Microsoft PFE, Ian Farr, back for more words of wisdom… Welcome to the third post in a four part series about securing and managing read-only domain controllers […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/7991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=7991"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/7991\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=7991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=7991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=7991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}